59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2

Analysis

max time kernel
99s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe
Size

288KB
MD5

6c86902bd3e358ccbf17dfe4a3e071d0
SHA1

57a1e267b74fac7aaf410d288b0967443b5432ba
SHA256

59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2
SHA512

7428b8cb9e0ff009a034344ef7033516bf594b780085b7305092f620ee271c803e3e8bae668337a88855fbeb6632632a799a39608cad7884de642d4b69702de2
SSDEEP

6144:hSlqsmY54h6UCw3wI/D7RFbvA1cK3TOwteq/j:Ir54h6UC1I/D7nAWrae

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4588 set thread context of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 4276	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	89
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90
PID 4588 wrote to memory of 2728	4588	59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe	90

C:\Users\Admin\AppData\Local\Temp\59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe
"C:\Users\Admin\AppData\Local\Temp\59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Users\Admin\AppData\Local\Temp\59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe"
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe
  "C:\Users\Admin\AppData\Local\Temp\59359550e3ad3737be83f23bfe819a91cecdb031dc994c49b25c40dff9d53ea2.exe"
  2⤵
  PID:2728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-135-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2728-137-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads